One particular fast-flux botnet called Avalanche has received much attention in recent months as a major platform for hosting phishing sites. What has not been discussed as much is how the distinction between phishing and malware has ceased to exist.

Avalanche offers a prime example of how blended attacks are launched from a fast-flux botnet platform. Arbor Networks reported earlier this month that the cybercriminal gangs behind the Avalanche botnet and the Zeus/Zbot malware have entered a partnership whereby the Zeus malware gang is using the Avalanche fast-flux botnet to launch its attacks. “We appear to be seeing one of the groups, Avalanche, promoting Zeus malware,” observed botnet security researcher Jose Nazario. “They don’t compete, and they both have good market positions, so they can grow each other.”

Recent blended attacks hosted on Avalanche reported this month targeted a major credit card company and a large Spanish bank operating in Latin America. Cybercriminals have teamed up their best-of-breed fast-flux and malware capabilities. MarkMonitor AntiFraud anticipated these developments with its unique preventive capabilities for preemptively detecting and shutting down fast-flux-based phishing and malware attacks.

More details about recent blended attacks hosted on the Avalanche platform:

December 11: http://news.zdnet.co.uk/security/0,1000000189,39933618,00.htm
December 12: http://garwarner.blogspot.com/2009/12/ongoing-visa-scam-drop-zeus-zbot.html
December 22: http://garwarner.blogspot.com/2009/12/donde-se-va-avalanche-bbva-y-united.html

Please find below brief synopses of these newly released documents.

Amended Guidebook Sections and Explanatory Memoranda

According to ICANN, many changes to the Draft Applicant Guidebook have been made as a result of the comments received to date. While revisions include amendments to the handling of geographical names, evaluation questions, comparative evaluation scoring, dispute resolution procedures and other registry agreement provisions, the requirement for Thick Whois appears to be the most notable. The public comment period for the guidebook excerpts will last from May 31, 2009 – July 20, 2009. The comments received together with the outcomes of the discussions relating to the overarching issues will constitute the basis for the third version of the guidebook that will be published at the end of the third quarter 2009.  

Analysis of Public Comment to Applicant Guidebook version 2

In response to the more than 200 comments received covering the second version of the Applicant Guidebook for new generic top-level domains, ICANN has published a comprehensive report. The report provides an analysis of the comments received and is broken into the following sections: General Concerns, Trademark Protections, TLD Demand and Economic Analysis, Potential for Malicious Conduct, Root Zone Scaling, Evaluation, Financial Considerations, Objection Process, Registry Agreement, String Contention, IDN and Respondents. 

Final Report on Trademark Protections in New gTLDs

The Implementation Recommendation Team (IRT) posted its final report which identified the following proposed solutions: IP Clearinghouse, Globally Protected Marks List and associated Rights Protection Mechanisms, and standardized pre-launch rights protection mechanisms; Uniform Rapid Suspension System; Post delegation dispute resolution mechanisms; Whois requirements for new TLDs; and Use of algorithm in string confusion review during initial evaluation. A public comment period covering the final report will last from May 29, 2009 to June 29, 2009. 

Draft Implementation Plan for the IDN ccTLD Fast Track Process

ICANN has released a revised Draft Implementation Plan for the IDN ccTLD Fast Track Process in an effort to elicit further community feedback both during and after the ICANN meeting in Sydney, Australia. A public comment period will last from May 31, 2009 to July 15, 2009. Comments received will be used to revise this implementation plan in preparation of a final version prior to ICANN’s meeting in Seoul, 26-30 October 2009.

New Registrar Contract

The new Registrar Contract consists of 17 amendments to the Registrar Accreditation Agreement (RAA). The amendments significantly increase the protections in place for domain registrants and the changes include: enhanced enforcement tools to assure full compliance with the ICANN contract and policies, expanded requirements for reseller agreements, additional audit and data escrow requirements, more explicit requirements for providing contact information, and new notice requirements and termination provisions. All new registrars will be required to sign the new agreement, as will any existing registrars that renew their accreditation.  

Root Server System Root Scaling Study

A study to determine the potential impact on the operation of the root server system of adding IPv6 address records, IDN top level names, other new TLDs, and new records to support DNS security to the root zone has been commissioned and will be completed by the end of August 2009.

The goal of the study is to construct a model of the root server system (including all of its provisioning and query components) that shows how the different parts are related, and how changing something in one part affects each of the other parts. A public comment period covering this study will last from May 28, 2009 to July 31, 2009.

In addition to the Applicant Guidebook, ICANN has also published a Summary/Analysis of Public Comments.

Based upon our preliminary evaluation of these documents, it appears as though ICANN has amended and clarified several issues including:

• The dispute resolution policy which will now allow for the submission of consolidated objections at the discretion of the Dispute Resolution Provider
• The definition of ‘Community-Based gTLDs’ and ‘Open gTLDs’
• The criteria used for comparative evaluation of ‘Community-Based’ applications
• The refund schedule which proposes that 70% refund for applications withdrawn after their posting, 35% refund for applications withdrawn after the initial evaluation, and 20% for any application withdrawn after any later stage
• Allowable channels of communication for technical support and exchanges of information with ICANN during the ‘Initial Evaluation’ and ‘Extended Evaluation’ periods
• A comprehensive description of auction processes to resolve issues of string contention

ICANN has also proposed a significant reduction in ongoing ‘Registry–Level Fees’ from $75,000 per year to $25,000 per year.

Unfortunately, the Applicant Guidebook does not address many of the concerns voiced by corporations and governments such as:

• Trademark protection
• Security and stability
• Malicious conduct
• Demand and economic analysis

ICANN intends to meet with the intellectual property community to work through specific suggestions for addressing these issues in the next 6-8 weeks.

The Public Comment Period for the second draft Applicant Guidebook is now open and will run through April 13, 2009.

According to ICANN, the third draft of the Applicant Guidebook is expected to be released in Q3 2009, and the application round will begin no sooner than December 2009.

MarkMonitor will monitor these developments closely and will follow-up with more detailed analysis and recommendations.

We  launched our new dotBrand Resource Center  this morning.  The resource center gathers information from a variety of sources, including ICANN, INTA, the media and MarkMonitor, and includes links to webinars, media articles, and an FAQ discussing the proposed generic top level domains (gTLDs). 

These new top level domains have the potential to change the Internet radically and the debate about potential opportunities and pitfalls is only begining.  We want to aid that discussion with the dotBrand Resource Center as brandholders and industry develop their strategies.  Please add suggestions in the Comments if you have ideas for additional content you’d like to see about the new top level domains.

For the second year in a row, we analyzed the state of the online pharmaceuticals market and examined online pharmacies, online advertising and B2B exchanges. We used six popular prescription drugs as our filter and found almost 3,000 online pharmacies offering one or more of these drugs; only two of the pharmacies were VIPPS-certified. 

Traffic to these sites had tripled from our study last year and we estimate that these pharmacies are driving approx. $12billion in revenue annually.  These pharmacies are spending serious money, too, in driving business; we estimate almost $26million in search advertising spending for illicit pharmacies for just those six keywords. Listings on B2B exchanges for bulk purchases of patented prescription drugs as well as their APIs (Active Pharmaceutical Ingredients) have grown since 2007; 59% of the listings identified in 2007 were still active during our study period.

The full report has many examples and also discusses our methodology in detail.   The report also discusses general brandjacking trends and phishing.  Cybersquatting continues as the tool of choice for brandjackers and phishers sought out new organizations aggressively; 35% of the organizations phished in Q2 of 2008 were first-time targets.

Press coverage for the report is available on our site, too, so you can see what some members of the press have to say about the Summer 2008 Brandjacking Index.

In the latest round of battles against Ebay by companies suffering from counterfeits, a Belgian court found Ebay not liable to L’Oreal for counterfeits sold on its site.

At least three cases against Ebay in Europe have been litigated seeking to hold Ebay liable for infringing counterfeits, two which have ruled against Ebay. At issue is the European Directive that protects companies facilitating e-commerce, and how this Directive is interpreted. Interesting- Ebay’s position that it is only a passive provider of Internet “hosting” services persuaded the Belgium court, but not the French or German courts, in recent cases against Ebay.

In contrast, the U.S. courts are willing to accept Ebay’s position that it is insulated from liability, and place the burden of fighting counterfeits squarely on the brand holder, such as in the Tiffany v. Ebay decision. Tiffany strongly objects to this principle, and continues to fight on by announcing that they have filed an appeal to this decision to the Federal 2^nd Circuit.

These conflicting decisions confuse brand holders seeking a quick resolution to their online counterfeit problem. For now, the never-ending cycle of sending take down notices for infringing items continues… although brand holders can expect a greater/quicker take down rate from websites seeking to avoid litigation costs and damages for infringement.